NordLayer vs Tailscale — Australia 2026

Evidenced differences

• Hosted gateway versus mesh overlay. NordLayer Lite documents Virtual Shared Gateways for internet access and geo masking. Virtual Private Gateways, dedicated IPs and IP allowlisting start on Core and require a dedicated-IP add-on (yearly grid +US$40/month, not mixed into the Lite seat). Tailscale’s default overlay is a WireGuard mesh to private nodes, subnet routers and ACLs; public internet traffic is left alone unless you opt into a customer-run exit node or the separate Mullvad add-on (US$5/month per 5 devices, beta). That is vendor documentation, not an app test and not a speed result.
• Introductory billed total and covered months. NordLayer Lite yearly billed 9600 USD cents for 12 covered months and renews at 9600 every 12 months. Tailscale Standard monthly billed 800 USD cents for 1 covered month and renews at 800 every month. 12-month cash is 9600 on both sides. 9600/12=800 equals the yearly intro. 800×12=9600 ≠ 800 because the monthly intro is one month. 9600+9600+9600=28800 on each side if the documented renewals are taken. Do not store 8×12=96 as a Tailscale yearly billed SKU. NordLayer Lite monthly 1000×12=12000 is not the yearly intro. Columns stay in USD. Cash is per listed user, not a team checkout. Core yearly, Premium, dedicated IP and the Mullvad add-on are not this cash table.
• Seat floor on the compared SKUs. NordLayer Lite/Core/Premium cards print a 5-user minimum. 5×9600=48000 USD cents is the 12-month listed floor on Lite yearly. Tailscale Standard documents occupied-seat billing with no 5-user minimum (stored minimum_seats 1). A one- to four-person organisation cannot treat the NordLayer per-user 9600 figure as a payable SKU. Checkout was not started, so whether the five-seat floor is enforced at payment is unknown.
• Private-resource access on the starting SKU. NordLayer Lite is documented as shared-gateway internet egress. Help: Lite has no Virtual Private Gateway. private_resource_access is plan_dependent and starts on Core with a dedicated-IP add-on. Tailscale documents ACLs/grants (private-resource access) on all plans including Personal; the reviewed business starting SKU is Standard. Do not buy NordLayer Lite — or personal NordVPN — for company private-resource access.
• Public internet egress. NordLayer Lite public_internet_egress is yes: shared gateways are the product. Tailscale public_internet_egress is yes but opt-in. The default overlay is split (tailnet only). A customer-run exit node (any plan) or the Mullvad add-on is required to send public internet traffic through a tunnel. DERP Australia (Sydney) is a relay for already-encrypted mesh traffic, not a public internet exit.
• Device caps and free tier. NordLayer help documents 6 devices per member. There is no free plan; 14-day money-back applies to an initial purchase. Tailscale documents unlimited user devices. Personal is US$0 for up to 6 users and is documented as non-commercial — not the Standard cash column. Custom-domain sign-up starts a 14-day business trial. Homepage coupon nl-fall-26 is not the NordLayer list grid.
• Advertised Australia / Sydney presence. NordLayer dedicated-IP help lists Australia (Sydney). Shared and private gateway pages list Australia. australian_exit_advertised is yes. Tailscale DERP docs and controlplane.tailscale.com/derpmap/default list Australia (Sydney), region syd — that is an encrypted relay, not a public internet exit. australian_exit_advertised is no. Neither record is Australian account data residency. Physical versus virtual remains unknown on both.
• Inspectable report scope. NordLayer help names UAB Sertika ISO/IEC 27001:2022 for NordLayer and NordPass Business. Trust Center ISO and HIPAA rows are Request-gated and were not opened. Pricing copy says SOC 2 Type I; help and the ISO page say Type 2 — dual public, unresolved. Tailscale publishes a SOC 2 Type II claim (security, availability, confidentiality); the legal hub says the report is confidential (log in or NDA) and it was not opened. Latacora assessments are on request via the DPA and were not opened. full_report_inspected is false on every stored row. A vendor badge is not a numeric security score.
• Legal entities and Five Eyes. NordLayer’s controller is Nord Security Inc. in New York. Terms are governed by England and Wales. Tailscale new accounts from 3 Sep 2024 contract with Tailscale US Inc. (Delaware); accounts existing 2 Sep 2024 remain Tailscale Inc. in Toronto. Five Eyes is yes on both stored legal-entity fields. Neither jurisdiction is Australian data residency. NordLayer account/control-plane hosting stays overseas (US controller; worldwide transfers). Tailscale privacy processing names Canada, Germany, the United States and the United Kingdom.
• Listed tax treatment. Both stored gst_basis values are exclusive. NordLayer pricing: VAT, sales tax or other mandatory tax is calculated additionally. Tailscale Terms §3.3: fees do not include sales/use/VAT; taxes appear separately on invoices. AU Chrome on Tailscale printed no GST line. Checkout was not started, so an Australian GST line was not observed. Listed USD cents are not GST-inclusive Australian checkout prices.
• Business versus consumer products. This pair is business remote access only. Personal NordVPN, Surfshark, Proton VPN and the other consumer listings are a different family. Tailscale Personal is documented as non-commercial and is not the Standard cash column. NordLayer Intelligence, NordPass, CrowdStrike add-ons and NordLayer Browser are separate. Tailscale Aperture, PAM and the Mullvad add-on are separate. Do not infer a consumer no-logs VPN from either admin product.

Buyer scenarios

Reproducible prepaid cash example

Horizons are cash charged, not prorated service. A 24-month prepaid is billed in full inside 12 months. Australian checkout totals stay unknown. Open the same plans in the cost tool

Hand checks: 9600/12=800; 800*12=9600; 800/1=800; 800*12=9600 ≠ 800.

• Cash outlay counts billed charges when they are taken. A 24-month prepaid is billed in full inside a 12-month horizon.
• The effective monthly figure is an average of the introductory billed total over covered months. It is not the cash charged each month.
• Australian checkout totals are unknown. Checkout was not started. Card FX fees are omitted.
• Exclusive listed amounts are before tax. VAT/GST that a checkout might add is not in the cash column.

Unknown on this pair

• Australian checkout totals (checkout was not started; both listed amounts are USD exclusive of tax; card FX fees omitted)
• AUD equivalent of the USD billed totals without a dated HTTPS FX quote — and that quote would still not be checkout
• Whether NordLayer’s five-user minimum is enforced at payment
• Tailscale sales-side annual billed totals (FAQ mentions them; no public yearly SKU was printed)
• Whether a NordLayer Monthly-label click would print monthlyPrice on a different client (this session’s SPAN click did not switch the cards)
• Dedicated-IP add-on and Mullvad add-on checkout totals
• Physical versus virtual Australian / Sydney locations on both products
• Account and control-plane data residency (data_hosting remains unknown on both)
• Inner pages of NordLayer Trust Center files and Tailscale’s login-gated SOC 2 PDF
• Independent speed, leak-test or streaming-unblocking results — not tested

Original conclusions from the record

• On the stored USD cards, NordLayer Lite yearly 12-month cash is 9600 USD cents and Tailscale Standard monthly 12-month cash is 9600 USD cents. Covered months are 12 versus 1. 9600/12=800 equals the yearly intro. 800×12=9600 ≠ 800 because the monthly intro is one month. 36-month cash is 9600+9600+9600=28800 on each side if the documented renewals are taken. Identical listed cents are not a ranking. Amounts are exclusive of tax; charged Australian totals stay unknown. 8×12=96 is not a Tailscale yearly billed SKU. NordLayer Lite monthly 1000×12=12000 is not the yearly intro.
• The documented five-user minimum is the cash difference that the per-user columns hide: 5×9600=48000 USD cents is NordLayer Lite yearly’s 12-month listed floor. Tailscale Standard has no 5-user minimum on the stored record. A one-person organisation cannot treat 9600 versus 9600 as the same payable total.
• Architecture is the product difference. NordLayer Lite is shared-gateway internet egress; private gateways start on Core with a dedicated-IP add-on. Tailscale Standard is a mesh overlay with ACLs; public internet egress is opt-in (exit node or Mullvad add-on). That is help-centre copy, not an app test.
• Inspectable report scope does not separate the pair: both stored audit rows are announcement-only or gated, with full_report_inspected false. Dual public NordLayer SOC 2 Type I versus Type 2 stays unresolved. Those are not numeric security scores.
• Both advertise some Australia/Sydney presence (NordLayer gateways/dedicated IP; Tailscale DERP relay). Neither record establishes Australian data residency. Both retain account, device and connection metadata; neither is a consumer no-logs VPN.
• This is not a ranked winner, not a numeric security score, and not a speed or streaming result. Personal browsing VPNs are out of scope for both business listings.

Sources

• NordLayer pricing (12 Sep 2026)
• NordLayer shared gateways
• NordLayer private gateways
• NordLayer device limit
• NordLayer MFA and SSO
• NordLayer security compliance (ISO/SOC announcements)
• NordLayer dedicated IP including Australia (Sydney)
• NordLayer advertised gateway locations
• NordLayer terms
• Tailscale pricing (12 Sep 2026)
• Tailscale exit nodes (opt-in internet egress)
• Tailscale DERP including Australia (Sydney)
• Tailscale ACLs
• Tailscale identity providers
• Tailscale legal hub (SOC 2 confidential)
• Tailscale terms

Calculation clock 2026-09-12. Product research dates stay 2026-09-12. Changing the evaluation time does not rewrite those checked dates.